General

  • Target

    ttd_scam_tool_api.exe

  • Size

    134.0MB

  • Sample

    240125-a862xadabp

  • MD5

    6ae4dad56fcd74438d8af1757d7f33eb

  • SHA1

    f7ebe503c1946803f4ab1396e633bfffdce75c39

  • SHA256

    7407aaf1912fe74b954790db86481e9f71b69d9ceb5da210366052c64cdf295a

  • SHA512

    3a86f8f1b9e8e5629a1f6097b8ca25905676cabd6083116e5c3a545b728e37ffe53f25571c86ca97f9727cebd5bf9a33250027af703728c3b94beb5de7a508dc

  • SSDEEP

    1536:nfEMGNYm3LveC4lOJqrkbH4HMAa7n6wBmMOQbY:8zGplOYrkbHj3sMOQk

Malware Config

Extracted

Family

xworm

C2

147.185.221.16:40164

Attributes
  • install_file

    tmp.exe

Targets

    • Target

      ttd_scam_tool_api.exe

    • Size

      134.0MB

    • MD5

      6ae4dad56fcd74438d8af1757d7f33eb

    • SHA1

      f7ebe503c1946803f4ab1396e633bfffdce75c39

    • SHA256

      7407aaf1912fe74b954790db86481e9f71b69d9ceb5da210366052c64cdf295a

    • SHA512

      3a86f8f1b9e8e5629a1f6097b8ca25905676cabd6083116e5c3a545b728e37ffe53f25571c86ca97f9727cebd5bf9a33250027af703728c3b94beb5de7a508dc

    • SSDEEP

      1536:nfEMGNYm3LveC4lOJqrkbH4HMAa7n6wBmMOQbY:8zGplOYrkbHj3sMOQk

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks